Jurisdiction-specific data protection, defamation law, and removal process information for Saudi Arabia. Last reviewed 2025.
Saudi Data and Artificial Intelligence Authority (SDAIA) â including the National Data Management Office (NDMO) is the supervisory authority for data protection in Saudi Arabia. Individuals can file erasure and data-related complaints directly with this authority.
Personal Data Protection Law (PDPL), Royal Decree No. M/19 (2021), enforceable from September 2023; Anti-Cybercrime Law 2007
Saudi Arabia's PDPL, enforceable from September 2023, includes a right to erasure. Data controllers must delete personal data upon request if there is no legitimate basis for retention. The law has extra-territorial reach, applying to Saudi residents' data regardless of where the processor is based.
The Anti-Cybercrime Law 2007 criminalises online content that infringes privacy, harms public order, or damages reputation. Penalties include significant fines and imprisonment. Saudi law provides no "public figure" exception comparable to Western jurisprudence.
Removal requests for online content in Saudi Arabia can be submitted to the SDAIA. The Anti-Cybercrime Unit (part of Saudi police) investigates online offences. Google's delisting process is available for search result removal. For Saudi-hosted content, formal government removal orders are the most effective route.
Common Saudi and regional sources requiring removal include Arab News, Saudi Gazette, Okaz, Al-Riyadh, Al Arabiya, and pan-Arab digital news platforms.
Saudi Arabia's PDPL has significant data localisation requirements for certain sensitive data categories, and businesses processing Saudi personal data must appoint a Saudi-based representative. This creates accountability obligations for international platforms with Saudi users.